gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?

Question

I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the buffer variable. Disassembly of main function is:-

(gdb) disas main
Dump of assembler code for function main:
0x080483f4 <main+0>:    push   ebp
0x080483f5 <main+1>:    mov    ebp,esp
0x080483f7 <main+3>:    and    esp,0xfffffff0
0x080483fa <main+6>:    sub    esp,0x60
0x080483fd <main+9>:    mov    DWORD PTR [esp+0x5c],0x0
0x08048405 <main+17>:   lea    eax,[esp+0x1c]
0x08048409 <main+21>:   mov    DWORD PTR [esp],eax
0x0804840c <main+24>:   call   0x804830c <gets@plt>
0x08048411 <main+29>:   mov    eax,DWORD PTR [esp+0x5c]
0x08048415 <main+33>:   test   eax,eax
0x08048417 <main+35>:   je     0x8048427 <main+51>
0x08048419 <main+37>:   mov    DWORD PTR [esp],0x8048500
0x08048420 <main+44>:   call   0x804832c <puts@plt>
0x08048425 <main+49>:   jmp    0x8048433 <main+63>
0x08048427 <main+51>:   mov    DWORD PTR [esp],0x8048529
0x0804842e <main+58>:   call   0x804832c <puts@plt>
0x08048433 <main+63>:   leave  
0x08048434 <main+64>:   ret    
End of assembler dump.

I set a break point on ret instruction and run the program but when I examine the stack in gdb, it shows this output(overflow after 90 A's):

(gdb) info registers
eax            0x29 41
ecx            0xb7fd84c0   -1208122176
edx            0xb7fd9340   -1208118464
ebx            0xb7fd7ff4   -1208123404
esp            0xbffff7bc   0xbffff7bc
ebp            0x41414141   0x41414141
esi            0x0  0
edi            0x0  0
eip            0x8048434    0x8048434 <main+64>
eflags         0x200246 [ PF ZF IF ID ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

When looking at ebp I am really curious to know that what happened that caused ebp to have value 0x41414141? What I understand is when leave isntruction is executed stack frame is destroyed and x/x $esp is 0x41414141 which makes sense and x/x $ebp is Cannot access memory at address 0x41414141 so how does value of ebp changed to 0x41414141?

PS: I already solved that exercise but while examining the stack I was not getting how ebp got changed and feel free to edit the question tag because I am not sure what tag will be appropriate.

Answer 1

The leave instruction is equivalent to:

mov esp, ebp
pop ebp

The second instruction pops the value on the top of the stack and stores it in ebp. In the case of a stack-based buffer overflow, your stack layout looks like:

<--- low addresses           high addresses --->
[ buffer being overflowed ][saved EBP][RET ADDR]
                           ^

When leave is executed, the mov esp, ebp instruction first restores esp to point at the marked location in the diagram above, then pops a value off the stack into ebp. So if you've overflowed the buffer with 'AAAA...', both the saved ebp and the return address will be set to 0x41414141.

Answer 2

For the CPU, ebp (and even esp most of the time) are not really different from eax, ebx and other registers. They can contain any data, not necessarily valid addresses. You only get problems (faults/exceptions) if you actually try to execute instructions that use those registers as addresses (directly or indirectly), or, in case of ESP, an interrupt happens.